# GuideHow to get started with learning ViewMatrix

#### Rake

Game Name
N/A
Anticheat
N/A
N/A
How long you been coding/hacking?
5 Years
Coding Language
Usually C++
What is a view matrix?
Matrices are used to define the location of things inside a coordinate system as well as how these things are projected onto your screen. There are actually several matrices used in 3D game programming they are:

• Model Matrix
• World Matrix
• View Matrix
• Projection Matrix

These are often all multiplied together and stored as another matrix named the Model-View-Projection Matrix. By using this matrix, you can do one transformation to move 3D coordinate into screen space.

A view matrix is 4 Vector3 structures that represents the camera position, it's viewport and frustrum. 3 of these vectors are the rotation matrix, representing the Right, Up & Forward (Look) axes. The other vector encodes the position. It can also be looked at as an array of 16 float values.

3D Game Programming uses view matrices to "transform" vertices of objects. The view matrix is used in our WorldToScreen() function to convert 3D world positions of entities to 2D screen space.

How to find the view matrix?

Why do you need the view matrix?
In order to make an ESP you need to know the 2D position of entities on the screen. To do this, you use a WorldToScreen function, but one of the required arguments is the view matrix. By using the transformation pipeline you can convert 3D coordinates to 2D coordinates.

This is done by using matrix math, most importantly Matrix Multiplication. Converting a 3D coordinate into screen space is referred to as a viewport transformation, and it uses the transformation pipeline.

Image credits: The Model Matrix

In order to write a WorldToScreen function you need to understand the transformation pipeline, you can learn more about it from these resources:

The absolute best resource to learning about viewport transformations
OpenGL Transformation

WorldToScreen functions for Direct3D, OpenGL, C++, C# and more
Source Code - World2Screen - DIrect3D and OpenGL WorldToScreen Functions

Best GH Resources:

Drawing
A normal Windows window uses this setup for it's coordinates:

Be sure that when you're making an ESP, your window is also set up like this. This way, all your code is consistent. When you pass things through your WorldToScreen you want to make sure you're using this system, it's what everyone uses. Some people do it a different way and it's just annoying to change everything months later. So start off doing it correctly to save yourself a headache

Last edited:

#### Drew

##### Newbie
Full Member
I want to make a hack for dayz standalone where there is a line drawn from bottom of the screen to the object (loot)
So far i have got the shader constants for the object by dissambling the vertexshader, here is the output

Inside my DrawIndexPrimitive Hook
if(primCount == 474) //gprimCount)
{
WorldToScreen(pDevice);
pDevice->SetRenderState(D3DRS_FILLMODE,D3DFILL_SOLID);
pDevice->SetRenderState(D3DRS_ZENABLE, true);
}

// Registers:
//
// Name Reg Size
// ----------------------------------------------------- ----- ----
// FogModeA b0 1
// FogModeB b1 1
// EnableAlignNormal b6 1
// VSC_PointLoopCount i0 1
// VSC_SpotLoopCount i1 1
// VSC_ViewMatrix c0 3
// VSC_ProjMatrix c3 4
// VSC_CameraPosition c7 1
// VSC_TexTransform c8 12
// VSC_InstanceColor c25 1
// VSC_SpecularPower_Alpha_FogEnd_RCPFogEndMinusFogSt art c31 1
// VSC_Free_ExpFog_AFogEnd_RCPAFogEndMinusAFogStart c34 1
// VSC_LWSMatrix c43 3
// LPSData c214 20
//

So this is my function

void WorldToScreen(IDirect3DDevice9* Device)
{
D3DVIEWPORT9 Viewport;
Device->GetViewport(&Viewport);

D3DXMatrixIdentity(&WorldToLocal);

D3DXVec3Project(&Vector2D,
&Vector3D,
&Viewport,
&Projecti********,
&ViewMatrix,
&WorldToLocal);
if(Vector2D.z < 1.0f)
{
X = static_cast<int>(Vector2D.x);
Y = static_cast<int>(Vector2D.y);
}
}

But its not working at all,looking for help to solve this so X,Y point to the correct location on screen

The Screenshot is the effect i want

#### Attachments

• 114.1 KB Views: 277

#### dzine

##### Newbie
hello guys,

i tried getting the address with cheatengine and the ingame function "setang".
i searched the whole forum and saw that this seems to work for people. but however not for me though.

here are the addresses i always get as a result from my search:

im currently using 0x597980 as the viewmatrix which doesnt seem to work.
i tried the rest of these but also without success,

#### Rake

hello guys,

i tried getting the address with cheatengine and the ingame function "setang".
i searched the whole forum and saw that this seems to work for people. but however not for me though.

here are the addresses i always get as a result from my search:

im currently using 0x597980 as the viewmatrix which doesnt seem to work.
i tried the rest of these but also without success,

hmm I don't know if you saw this
'

Tutorial - WorldToScreenMatrix Source Engine

Last edited:

#### OfficialHydrux

##### Newbie
Full Member
Have you tried this

First step :

Set ViewAngle.x to 89.0
Set ViewAngle.y to 49.0

Search for 0.75 !

Second step :

Set ViewAngle.x to 0.0
Set ViewAngle.y to 5.0

Search for 0.08 !

[CSGO] The second client.dll entry in the list should be your vMatrix flicker free offset
[CSS] The last engine.dll entry in the list should be your vMatrix flicker free offset

Last edited:

#### Niiw

##### Newbie
Full Member
Have you tried this

For those who struggle follow these steps (I promise you will find the viewMatrix very easily)

Open CheatEngine, and attach to "hl2.exe" process.

Select "Float" and "Unknown initial value" and do the first scan

Now open console and as OfficialHydrux mentionned, we have to set our view angles.

To do this, paste this in your console : sv_cheats 1 (this will enable cheat mode in the game)

Now, still in the console, type : Setang 89 49 0 (<--we set the angles manually, you will see that the player will move)

Now go back in CheatEngine and make sure your settings are like mine :

Make sure you put 0.75 and press Next scan !

(I passed from 75.000.000 values to 33.000 after this ^^)

Now go back in counter strike and in the console type: Setang 0 5 0

Go back in cheat engine, and make sure you select "Rounded (extrem)"

and Press Next Scan

Now you will have not alot of adresses.. I have 38 left

Let's try this one more time... Go back to CSS, in console : Setang 89 49 0

Go back in cheat engine : put 0.75 and Next scan

Gp back in CSS : Setang 0 5 0

Go back in Cheat Engine : put 0.08 and Next Scan

Okay so now we have 33 addresses. In counter strike source, you have alot of static adresses (green ones)
you can be 99,99% sure that the viewMatrix is in the green adresses that are left.

So select all the black ones and right click & "Remove"

So now I have 15 green addrresses left (they are pointers )

What's left to do?

Test each one of them one by one until you find the good one.

15 is not alot and is very fast to test.

I followed Fleep's ESP tutorial.

And So to test them, you select all of them and press the red arrow so that they go at the bottom:

Now we have to check each adress. The viewMatrix is stored in engine.dll module.
So double-click on each adress one-by-one and look if it starts with "engine.dll"+xxxx

IF YES, leave it
IF NO, delete it

For example :

this we leave:

this or this we delete

No we have very small amount of addresses left, this is good

Personnaly, I had 8 left after all this.

Nearly finished. So now we test them !

Take each address one by one, double-click and copy whats after "engine.dll"+xxx

And past them in your code & run your ESP hack to see if it's the good one.

When you will have the right address, the ESP will work great !

Last edited by a moderator:

#### rogerxiii

##### Newbie
Hi all,

I'm making an external ESP hack, based on Fleep's code, for a lot of games.
The only offset I'm having trouble with finding is the vMatrix.
Anyone have any tips on finding this address through Cheat Engine?
Or do I need to use a debugger like olly?

The game specifically is Call of Duty: Black Ops 2.

Thanks.

#### rogerxiii

##### Newbie
I have no experience with direct3d programming, but this is what I did. I tried to set a breakpoint in olly for the function call GetTransform, but the game doesn't execute my breakpoint. What exactly am I supposed to do with that then?

#### rogerxiii

##### Newbie
Are you trying to do a ReadProcessMemory only ESP? If so I'd try to make it FOV based. If you're working internally create a D3D hook first (EndScene or Present, there are good public hooks) then try finding the ViewMatrix (whatever way via Memory or GetTransform).
Yes, only reading memory since I can't be arsed getting it to work with the anti-cheats. How do you propose I make it FOV based? Just beginning with game hacking.

#### jenscrevits

##### Newbie
Warning: No Requesting Help Without Effort
i cant seem to find the scum view matrix, can someone find it for me pls?

#### mambda

Escobar Tier VIP
Trump Tier Donator
not a place where people do your work for you. its a place where people help you arrive to the answer yourself. If you want to be spoon fed its a simple google search away

#### iPower

##### Former game hacker
Escobar Tier VIP
Fleep Tier Donator

#### 4cc57d33

Hello, I successfully hooked openGL SwapBuffers and now I want to draw a line from the top left corner of the window to Entity. But all the address for viewmatrix I have found are wrong.

I have used Rake W2S function for openGL, my implementation :

C++:
bool WorldToScreen(Vector3 pos, Vector3& screen, float matrix[16], int windowWidth, int windowHeight) {
//Matrix-vector Product, multiplying world(eye) coordinates by projection matrix = clipCoords
Vector4 clipCoords;
clipCoords.x = pos.x * matrix[0] + pos.y * matrix[4] + pos.z * matrix[8] + matrix[12];
clipCoords.y = pos.x * matrix[1] + pos.y * matrix[5] + pos.z * matrix[9] + matrix[13];
clipCoords.z = pos.x * matrix[2] + pos.y * matrix[6] + pos.z * matrix[10] + matrix[14];
clipCoords.w = pos.x * matrix[3] + pos.y * matrix[7] + pos.z * matrix[11] + matrix[15];

if (clipCoords.w < 0.1f)
return false;

//perspective division, dividing by clip.W = Normalized Device Coordinates
Vector3 NDC;
NDC.x = clipCoords.x / clipCoords.w;
NDC.y = clipCoords.y / clipCoords.w;
NDC.z = clipCoords.z / clipCoords.w;

//Transform to window coordinates
screen.x = (windowWidth / 2 * NDC.x) + (NDC.x + windowWidth / 2);
screen.y = -(windowHeight / 2 * NDC.y) + (NDC.y + windowHeight / 2);
return true;
}

void hwglSwapBuffers(_In_ HDC hDc) {
EntityManager::UpdateEntity();
Aimbot::Init();

for (auto& i : EntityManager::m_EnemyPlayers) {
Vector3 pos;
WorldToScreen(i->position, pos, Viewmatrix::GetInstance()->matrix, Window::GetInstance()->Width, Window::GetInstance()->Height);

std::cout << pos.x << " " << pos.y << " " << pos.z << std::endl;

DrawLine(0, 0, (int)pos.x, (int)pos.y);
}
}
sauerbraten.exe+297A08
sauerbraten.exe+297B1C
sauerbraten.exe+297E48
sauerbraten.exe+2996C8

#### SystemX32

Dank Tier VIP
Dank Tier Donator
For my Cube 2: Sauerbraten cheat, I used sauerbraten.exe+0x13E71C as the view matrix. I also used the exact same W2S function as you. I found this address by following this tutorial:

Rake

#### kevin5881413

##### Newbie
Full Member
If we find that the matrix in the game is a view matrix, why don't we need a projection matrix?
Which kind of matrix do we find in the game?? Is the View Matrix or Model-View-Projection Matrix ??

I'm confused...

#### mambda

Escobar Tier VIP
Trump Tier Donator
If we find that the matrix in the game is a view matrix, why don't we need a projection matrix?
Which kind of matrix do we find in the game?? Is the View Matrix or Model-View-Projection Matrix ??

I'm confused...
to convert from world coordinates you need the (model)view-projection matrix. Its been colloquially described as the "view matrix" online, though thats obv not accurate

kevin5881413

#### Rake

If we find that the matrix in the game is a view matrix, why don't we need a projection matrix?
Which kind of matrix do we find in the game?? Is the View Matrix or Model-View-Projection Matrix ??

I'm confused...
I explain this in the videos, maybe you should watch them?

#### kevin5881413

##### Newbie
Full Member
I explain this in the videos, maybe you should watch them?
I mixed view matrix A.k.a (model view-projection matrix ) with View Matrix. Sorry about that

#### kevin5881413

##### Newbie
Full Member
to convert from world coordinates you need the (model)view-projection matrix. Its been colloquially described as the "view matrix" online, though thats obv not accurate
thanks i got it

#### Rake

I got a new idea on finding view matrices on any game, it's universal

Here is a matrix copy function from L4D2 Source, it takes the matrix in the address held by ECX and copies it into the EAX address:

This is basically the same in every game. Forget about the beginning and end of the function, just focus on the pushing on popping of float values on the FPU stack, skip the first 2 instructions also just in case.

You get:

D9 41 04 D9 58 04 D9 41 08 D9 58 08 D9 41 0C D9 58 0C D9 41 10 D9 58 10 D9 41 14 D9 58 14 D9 41 18 D9 58 18 D9 41 1C D9 58 1C D9 41 20 D9 58 20 D9 41 24 D9 58 24 D9 41 28 D9 58 28 D9 41 2C D9 58 2C D9 41 30 D9 58 30 D9 41 34 D9 58 34 D9 41 38 D9 58 38 D9 41 3C D9 58 3C

Now, what if the game uses different registers? Make your pattern work with any registers:

D9 ?? 04 D9 ?? 04 D9 ?? 08 D9 ?? 08 D9 ?? 0C D9 ?? 0C D9 ?? 10 D9 ?? 10 D9 ?? 14 D9 ?? 14 D9 ?? 18 D9 ?? 18 D9 ?? 1C D9 ?? 1C D9 ?? 20 D9 ?? 20 D9 ?? 24 D9 ?? 24 D9 ?? 28 D9 ?? 28 D9 ?? 2C D9 ?? 2C D9 ?? 30 D9 ?? 30 D9 ?? 34 D9 ?? 34 D9 ?? 38 D9 ?? 38 D9 ?? 3C D9 ?? 3C

This pattern should match any game that makes copies of matrices (well any array of floating points which is 0x40 in size)

You can then hook all these functions and hopefully it accesses the proper view matrix.

Here is what it looks like for CSGO:

Here is the pattern for CSGO:
8B ?? 04 89 ?? 04 8B ?? 08 89 ?? 08 8B ?? 0C 89 ?? 0C 8B ?? 10 89 ?? 10 8B ?? 14 89 ?? 14 8B ?? 18 89 ?? 18 8B ?? 1C 89 ?? 1C 8B ?? 20 89 ?? 20 8B ?? 24 89 ?? 24 8B ?? 28 89 ?? 28 8B ?? 2C 89 ?? 2C 8B ?? 30 89 ?? 30 8B ?? 34 89 ?? 34 8B ?? 38 89 ?? 38 8B ?? 3C 89 ?? 3C

Gonna test this idea on a couple games, it already worked on L4D2, thank you @Icew0lf for this idea

Last edited: